Heap-based buffer overflow in UltraVNC - CVE-2019-8262

Vulnerability identifier: #VU22964

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8262

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in VNC client code inside Ultra decoder. A remote attacker that controls a malicious VNC server can trick a user to connect to it, trigger heap-based buffer overflow and execute arbitrary code with privileges of the user, running the VNC client.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

UltraVNC
SIMATIC WinCC Runtime Advanced
SIMATIC HMI KTP900F
SIMATIC HMI KTP900
SIMATIC HMI KTP700F
SIMATIC HMI KTP700
SIMATIC HMI KTP400F
SIMATIC HMI Comfort Panels 4”-22”
SIMATIC HMI Comfort Outdoor Panels 7” & 15”

Install updates from vendor's website.

UltraVNC - update to 1.2.2.3
SIMATIC WinCC Runtime Advanced - update to 16 Update 4
SIMATIC HMI KTP900F - update to 16 Update 4
SIMATIC HMI KTP900 - update to 16 Update 4
SIMATIC HMI KTP700F - update to 16 Update 4
SIMATIC HMI KTP700 - update to 16 Update 4
SIMATIC HMI KTP400F - update to 16 Update 4
SIMATIC HMI Comfort Panels 4”-22” - update to 16 Update 4
SIMATIC HMI Comfort Outdoor Panels 7” & 15” - update to 16 Update 4

• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-008-ultravnc-heap-based-buffer-overflow/

• Multiple vulnerabilities in UltraVNC
• Multiple vulnerabilities in Siemens SIMATIC UltraVNC HMI WinCC Products